Signed-off-by: laurentsimon <laurentsimon@google.com>
pull/1243/head
laurentsimon 3 years ago
parent 54f83700bd
commit 1dd17ac4cf

@ -93,10 +93,10 @@ Docker Linux packages also include Docker Buildx when installed using the
You can also download the latest binary from the [GitHub releases page](https://github.com/docker/buildx/releases/latest). You can also download the latest binary from the [GitHub releases page](https://github.com/docker/buildx/releases/latest).
We generate [SLSA3 provenance](slsa.dev) using the OpenSSF's [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) during the release process. To verify a relase binary: We generate [SLSA3 provenance](slsa.dev) using the OpenSSF's [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) during the release process. To verify a relase binary:
1. Install the verification tool from [slsa-framework/slsa-verifier#installation](https://github.com/slsa-framework/slsa-verifier#installation). 1. Install the verification tool from [slsa-framework/slsa-verifier#installation](https://github.com/slsa-framework/slsa-verifier#installation).
2. Download the provenance file `attestation.intoto.jsonl`. 2. Download the provenance file `attestation.intoto.jsonl` from the [GitHub releases page](https://github.com/docker/buildx/releases/latest).
3. Run: 3. Run the verifier:
```shell ```shell
slsa-verifier -artifact-path buildx-v1.darwin-amd64 -provenance attestation.intoto.jsonl -source github.com/docker/buildx -branch master slsa-verifier -artifact-path <the-binary> -provenance attestation.intoto.jsonl -source github.com/docker/buildx -branch master
``` ```
Rename the relevant binary and copy it to the destination matching your OS: Rename the relevant binary and copy it to the destination matching your OS:

Loading…
Cancel
Save